@wix/himalaya-cli 0.1436.0 → 0.1438.0

package/dist/cli.mjs

@@ -6939,7 +6939,7 @@ function validator(schema) {
 }
 function compileV2(html, profile, options) {
   const diagnostics = [], sourceMap2 = {}, dependencies = [options.file];
-  const requiredCapabilities = /* @__PURE__ */ new Set();
+  const requiredCapabilities2 = /* @__PURE__ */ new Set();
   const $2 = cheerio2.load(html, { sourceCodeLocationInfo: true });
   const loc = (el2) => ({ file: options.file, line: el2?.sourceCodeLocation?.startLine ?? 1, column: el2?.sourceCodeLocation?.startCol ?? 1 });
   const error = (el2, code, message, hint) => diagnostics.push({ ...loc(el2), code, severity: "error", message, ...hint ? { hint } : {} });
@@ -6973,7 +6973,7 @@ function compileV2(html, profile, options) {
     } else error(script, "HHP-SCRIPT", "Use one external application/himalaya-controller script. Inline/page JavaScript is unavailable.");
   }
   let info4;
-  for (const cap of moduleCapabilities(controller?.source ?? directService?.source ?? "", controller?.file ?? options.file, profile)) requiredCapabilities.add(cap);
+  for (const cap of moduleCapabilities(controller?.source ?? directService?.source ?? "", controller?.file ?? options.file, profile)) requiredCapabilities2.add(cap);
   if (controller) {
     dependencies.push(controller.file);
     info4 = analyzeController(controller.source, controller.file, profile, diagnostics);
@@ -7049,7 +7049,7 @@ function compileV2(html, profile, options) {
         if (!info4?.handlers.has(action.slice(`tier5.${serviceName}.`.length))) error(el2, "HHP-EVENT", `Unknown structured handler ${action}.`);
       } else if (action.startsWith("capability.")) {
         const [, cap, method] = action.split(".");
-        requiredCapabilities.add(cap);
+        requiredCapabilities2.add(cap);
         if (!grants(profile.declaredCapabilities, cap)) error(el2, "HHP-CAPABILITY-MISSING", `Action requires declared capability ${cap}.`);
         if (!own5(profile.capabilities, cap)?.methods.includes(method)) error(el2, "HHP-EVENT", `Unknown capability method ${action}.`);
       } else if (!profile.handlers?.includes(action)) error(el2, "HHP-EVENT", `Action ${action} is not declared by this app.`);
@@ -7288,7 +7288,7 @@ function compileV2(html, profile, options) {
     if (tag === "a") {
       if (attrs.href?.startsWith("#")) props.action = { actionId: "himi.open", params: { screenId: attrs.href.slice(1) } };
       else if (/^https:\/\//.test(attrs.href ?? "")) {
-        requiredCapabilities.add("open_url");
+        requiredCapabilities2.add("open_url");
         if (!grants(profile.declaredCapabilities, "open_url")) error(el2, "HHP-CAPABILITY-MISSING", "External links require open_url.");
         props.action = { actionId: "capability.open_url.open", args: { url: attrs.href } };
       } else error(el2, "HHP-LINK", "Links require #screenId or an HTTPS URL.");
@@ -7419,7 +7419,7 @@ ${directService.source}
     bundleName,
     sourceMap: sourceMap2,
     dependencies,
-    manifest: { profileVersion: "hhp/2", catalogVersion: profile.catalogVersion, screenId, bundleName, serviceName: info4 ? serviceName : null, requiredCapabilities: [...requiredCapabilities].sort(), inputSha256: createHash6("sha256").update(html).digest("hex") }
+    manifest: { profileVersion: "hhp/2", catalogVersion: profile.catalogVersion, screenId, bundleName, serviceName: info4 ? serviceName : null, requiredCapabilities: [...requiredCapabilities2].sort(), inputSha256: createHash6("sha256").update(html).digest("hex") }
   };
 }
 var camel, semantic, actionAliases, ajv, validators;
@@ -8022,6 +8022,7 @@ function buttonVariant(style) {
 var SYSTEM_FONT_FAMILY, TONAL_ELEVATION_ALPHA, BUTTON_MIN_HIT_TARGET, nonNegative, nonEmpty2, own, COLOR_TOKEN_PROPS, TYPOGRAPHY_TOKEN_PROPS, BUTTON_VARIANTS;
 var init_tokens = __esm({
   "../../core/ts/src/tokens.ts"() {
+    "use strict";
     SYSTEM_FONT_FAMILY = "$system";
     TONAL_ELEVATION_ALPHA = [0, 0.05, 0.08, 0.11, 0.12, 0.14];
     BUTTON_MIN_HIT_TARGET = 44;
@@ -8077,6 +8078,7 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -15049,7 +15051,7 @@ async function compileContentHhp(root, opts = {}) {
       seen.add(file3);
       const source = readFileSync16(file3, "utf8");
       inspectModule(source, file3, profile, diagnostics);
-      for (const cap of moduleCapabilities(source, file3, profile)) requiredCapabilities.add(cap);
+      for (const cap of moduleCapabilities(source, file3, profile)) requiredCapabilities2.add(cap);
       const sf2 = ts3.createSourceFile(file3, source, ts3.ScriptTarget.Latest, true);
       for (const stmt of sf2.statements) if ((ts3.isImportDeclaration(stmt) || ts3.isExportDeclaration(stmt)) && stmt.moduleSpecifier && ts3.isStringLiteral(stmt.moduleSpecifier) && stmt.moduleSpecifier.text.startsWith(".")) {
         let imported = localPath(root, stmt.moduleSpecifier.text, file3);
@@ -15064,9 +15066,9 @@ async function compileContentHhp(root, opts = {}) {
     diagnostics.push(...result2.diagnostics);
     results.push(result2);
     const seen = /* @__PURE__ */ new Set();
-    const requiredCapabilities = new Set(result2.manifest.requiredCapabilities);
+    const requiredCapabilities2 = new Set(result2.manifest.requiredCapabilities);
     for (const dependency of result2.dependencies.filter((f2) => /\.tsx?$/.test(f2))) inspect2(dependency);
-    result2.manifest.requiredCapabilities = [...requiredCapabilities].sort();
+    result2.manifest.requiredCapabilities = [...requiredCapabilities2].sort();
     outputs.set(`dev/hhp/${id}.descriptor.json`, JSON.stringify(result2.descriptor, null, 2) + "\n");
     outputs.set(`dev/hhp/${id}.map.json`, JSON.stringify({ ...result2.manifest, nodes: Object.fromEntries(Object.entries(result2.sourceMap).map(([key3, node]) => [key3, { ...node, file: relative3(root, node.file).split(sep6).join("/") }])) }, null, 2) + "\n");
     if (result2.worker && result2.bundleName) {
@@ -20698,14 +20700,15 @@ async function localDbEntities(dir) {
   const names2 = (schema?.entities ?? []).map((e2) => e2?.name).filter((n2) => typeof n2 === "string" && n2.length > 0);
   return names2.length ? names2.map((name) => ({ name })) : null;
 }
-function renderMocksFrom(rules, bad2, seeded) {
-  if (rules || seeded) {
+function renderMocksFrom(rules, bad2, seeded, base44) {
+  if (rules || seeded || base44) {
     return {
       mocks: {
         rules: rules?.rules ?? null,
         cmsSeed: seeded,
-        from: [...rules ? [rules.from] : [], ...seeded ? ["config cms seed rows"] : []],
-        ...bad2 ? { ignored: `the net mocks could not be read (${bad2}), so only the cms seed rows were used` } : {}
+        ...base44 ? { base44Data: base44 } : {},
+        from: [...rules ? [rules.from] : [], ...seeded ? ["config cms seed rows"] : [], ...base44 ? ["Base44 seed / book sample rows"] : []],
+        ...bad2 ? { ignored: `the net mocks could not be read (${bad2}), so only ${[...seeded ? ["the cms seed rows"] : [], ...base44 ? ["the Base44 seed / book sample rows"] : []].join(" and ")} were used` } : {}
       }
     };
   }
@@ -22771,6 +22774,9 @@ var init_plan = __esm({
 });
 
 // ../../core/sdk/capability-catalog/src/builtins.ts
+function hasBuiltin(platform, id) {
+  return CAPABILITY_BUILTINS[platform].includes(id);
+}
 var IOS_BUILTINS, WEB_BUILTINS, CAPABILITY_BUILTINS;
 var init_builtins = __esm({
   "../../core/sdk/capability-catalog/src/builtins.ts"() {
@@ -23279,6 +23285,10 @@ function binaryCoreSatellitePath(product) {
 function mavenArtifactForGradleProject(project) {
   return project.replace(/^:/, "");
 }
+function binaryModuleLinks(buildSet2) {
+  const { spm, gradle } = modulesFor(buildSet2);
+  return { spm, maven: gradle.map((g2) => `${BINARY_CORE_MAVEN_GROUP}:${mavenArtifactForGradleProject(g2)}`) };
+}
 function coreVersionHasModules(version4) {
   const parse4 = (v2) => /^(\d+)\.(\d+)\.(\d+)/.exec(v2.trim())?.slice(1).map(Number);
   const a2 = parse4(version4);
@@ -23337,6 +23347,58 @@ var init_binary_core = __esm({
 });
 
 // ../../core/sdk/capability-catalog/src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  BINARY_CORE_ANDROID_PUBLISH_BUILDS: () => BINARY_CORE_ANDROID_PUBLISH_BUILDS,
+  BINARY_CORE_IOS_PATH_ONLY_SATELLITES: () => BINARY_CORE_IOS_PATH_ONLY_SATELLITES,
+  BINARY_CORE_IOS_SATELLITES: () => BINARY_CORE_IOS_SATELLITES,
+  BINARY_CORE_IOS_TRAIT_SATELLITES: () => BINARY_CORE_IOS_TRAIT_SATELLITES,
+  BINARY_CORE_IOS_TRAIT_SELECTOR: () => BINARY_CORE_IOS_TRAIT_SELECTOR,
+  BINARY_CORE_MAVEN_GROUP: () => BINARY_CORE_MAVEN_GROUP,
+  BINARY_CORE_MODULES_SINCE: () => BINARY_CORE_MODULES_SINCE,
+  BINARY_CORE_PRE_SPLIT_USAGE_STRINGS: () => BINARY_CORE_PRE_SPLIT_USAGE_STRINGS,
+  BINARY_CORE_SPM_PACKAGE: () => BINARY_CORE_SPM_PACKAGE,
+  BINARY_CORE_USAGE_STRINGS: () => BINARY_CORE_USAGE_STRINGS,
+  BRIDGE_CAPABILITY_IDS: () => BRIDGE_CAPABILITY_IDS,
+  CAPABILITY_BUILTINS: () => CAPABILITY_BUILTINS,
+  CAPABILITY_IMPLIES: () => CAPABILITY_IMPLIES,
+  CAPABILITY_NATIVE: () => CAPABILITY_NATIVE,
+  CATALOG_CAPABILITY_IDS: () => CATALOG_CAPABILITY_IDS,
+  COMPONENT_MODULES: () => COMPONENT_MODULES,
+  KNOWN_CAPABILITY_IDS: () => KNOWN_CAPABILITY_IDS,
+  NATIVE_MODULES: () => NATIVE_MODULES,
+  NOT_DIST_ADDABLE: () => NOT_DIST_ADDABLE,
+  androidPlanFor: () => androidPlanFor,
+  binaryCoreSatellitePath: () => binaryCoreSatellitePath,
+  binaryCoreSatelliteTrait: () => binaryCoreSatelliteTrait,
+  binaryCoreUsageStringsFor: () => binaryCoreUsageStringsFor,
+  binaryCoreVersion: () => binaryCoreVersion,
+  binaryModuleLinks: () => binaryModuleLinks,
+  capabilitiesOfModule: () => capabilitiesOfModule,
+  capabilitiesUsedBy: () => capabilitiesUsedBy,
+  capabilityDispatchesIn: () => capabilityDispatchesIn,
+  catalogKey: () => catalogKey,
+  componentModuleRequirements: () => componentModuleRequirements,
+  coreVersionHasModules: () => coreVersionHasModules,
+  distAddRefusal: () => distAddRefusal,
+  distributionOptIns: () => distributionOptIns,
+  expandCapabilities: () => expandCapabilities,
+  grants: () => grants,
+  hasBuiltin: () => hasBuiltin,
+  iosPlanFor: () => iosPlanFor,
+  isBinaryCore: () => isBinaryCore,
+  isKnownCapability: () => isKnownCapability,
+  linksModule: () => linksModule,
+  macosPlanFor: () => macosPlanFor,
+  mavenArtifactForGradleProject: () => mavenArtifactForGradleProject,
+  moduleForGradleProject: () => moduleForGradleProject,
+  moduleForSpmProduct: () => moduleForSpmProduct,
+  modulesFor: () => modulesFor,
+  nativeRequirementsFor: () => nativeRequirementsFor,
+  needsNativeBuild: () => needsNativeBuild,
+  unlinkedComponentModules: () => unlinkedComponentModules,
+  usageStringCopyFor: () => usageStringCopyFor
+});
 var init_src2 = __esm({
   "../../core/sdk/capability-catalog/src/index.ts"() {
     init_types();
@@ -131109,8 +131171,8 @@ var init_AppRegistry = __esm({
 });
 
 // ../../core/web-renderer/src/index.ts
-var src_exports = {};
-__export(src_exports, {
+var src_exports2 = {};
+__export(src_exports2, {
   Bound: () => Bound,
   BoundList: () => BoundList,
   FakeServiceProvider: () => FakeServiceProvider,
@@ -131471,7 +131533,7 @@ async function renderDescriptorWeb(descriptor, tokens2, scheme, wantPng, service
   ) : void 0;
   let html;
   try {
-    const { renderDescriptorToHtml: renderDescriptorToHtml2 } = await Promise.resolve().then(() => (init_src5(), src_exports));
+    const { renderDescriptorToHtml: renderDescriptorToHtml2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
     html = renderDescriptorToHtml2(
       payload,
       tokens2 ?? {},
@@ -131741,7 +131803,7 @@ async function pngFontFaceCss(tokens2, opts = {}) {
   return rules.join("");
 }
 async function idiomFontFaceCss(idiomContext) {
-  const { controlIdiomFor: controlIdiomFor2, idiomControls: idiomControls2 } = await Promise.resolve().then(() => (init_src5(), src_exports));
+  const { controlIdiomFor: controlIdiomFor2, idiomControls: idiomControls2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
   const bundled = idiomControls2(controlIdiomFor2(idiomContext)).font.bundled;
   if (!bundled) return "";
   try {
@@ -140221,6 +140283,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         knownScreenIds: /* @__PURE__ */ new Set(),
         rules: collect2.render.mocks.rules ?? null,
         ...collect2.render.mocks.cmsSeed ? { cmsSeed: collect2.render.mocks.cmsSeed } : {},
+        ...collect2.render.mocks.base44Data ? { base44Data: collect2.render.mocks.base44Data } : {},
         localDbSchema: appLocalDbSchema,
         ...collect2.render.loadBudgetMs ? { budgetMs: collect2.render.loadBudgetMs } : {},
         transportWrap: (call) => async (method, path2, body) => {
@@ -140278,7 +140341,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   };
   let handlers;
   let minBinaryVersion = null;
-  const requiredCapabilities = new Set(config.capabilities ?? []);
+  const requiredCapabilities2 = new Set(config.capabilities ?? []);
   const capabilityUsage = {
     app: [...config.capabilities ?? []],
     ...Array.isArray(config.capabilityEnvelope) ? { envelope: [...config.capabilityEnvelope] } : {},
@@ -140289,7 +140352,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     const ids = Array.isArray(declared) ? declared.filter((c2) => typeof c2 === "string") : [];
     const components2 = [...collectComponentTypes(descriptor)].sort();
     capabilityUsage.screens.push({ screenId, bundle, declared: ids, components: components2 });
-    for (const c2 of componentModuleRequirements(components2, [...requiredCapabilities, ...ids])) requiredCapabilities.add(c2);
+    for (const c2 of componentModuleRequirements(components2, [...requiredCapabilities2, ...ids])) requiredCapabilities2.add(c2);
   };
   const requiredNativeComponents = /* @__PURE__ */ new Set();
   const tierScreens = [];
@@ -140533,7 +140596,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         minBinaryVersion = maximumBinaryVersion(minBinaryVersion, lb.minBinaryVersion);
         const declared = lb.declaredCapabilities ?? lb.declared_capabilities;
         if (Array.isArray(declared)) {
-          for (const capability of declared) if (typeof capability === "string") requiredCapabilities.add(capability);
+          for (const capability of declared) if (typeof capability === "string") requiredCapabilities2.add(capability);
         }
         noteScreenCapabilities(screenId, bundleName, declared, descriptor);
       } else {
@@ -140683,7 +140746,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             minBinaryVersion = maximumBinaryVersion(minBinaryVersion, lb.minBinaryVersion);
             const declared = lb.declaredCapabilities ?? lb.declared_capabilities;
             if (Array.isArray(declared)) {
-              for (const c2 of declared) if (typeof c2 === "string") requiredCapabilities.add(c2);
+              for (const c2 of declared) if (typeof c2 === "string") requiredCapabilities2.add(c2);
             }
             noteScreenCapabilities(screenId, bundleName, declared, descriptor);
           } else {
@@ -140851,7 +140914,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     // whose source catalog serves copy (native screens, #4221/#4250) now carries `en` here.
     ...Object.keys(catalogs).length ? { catalogs } : {},
     playerRequirements: {
-      capabilities: [...requiredCapabilities].sort(),
+      capabilities: [...requiredCapabilities2].sort(),
       nativeComponents: [...requiredNativeComponents].sort(),
       // `none` is the scaffold's spelling of "no auth" (`new-app --auth=none`), not a provider a
       // host must carry — recording it blocked every such app in the Player picker (#3695).
@@ -167793,10 +167856,13 @@ __export(plan_exports, {
   RESERVED_SCREEN_IDS: () => RESERVED_SCREEN_IDS,
   displayName: () => displayName2,
   gateFor: () => gateFor,
+  hasLinkField: () => hasLinkField,
   humanize: () => humanize,
+  missingCapabilities: () => missingCapabilities,
   planEntity: () => planEntity,
   planEntityScreens: () => planEntityScreens,
   pluralize: () => pluralize,
+  requiredCapabilities: () => requiredCapabilities,
   rowTitleField: () => rowTitleField,
   snake: () => snake
 });
@@ -167872,6 +167938,12 @@ function fieldReadOnly(f2) {
   const rls = f2.rls;
   return !!rls && typeof rls === "object" && "write" in rls && rls.write !== true;
 }
+function requiredCapabilities(sp) {
+  return ["base44", ...sp.plans.some(hasLinkField) ? ["open_url"] : []];
+}
+function missingCapabilities(sp, declared) {
+  return requiredCapabilities(sp).filter((c2) => !declared.has(c2)).map((capability) => ({ capability, entities: (capability === "open_url" ? sp.plans.filter(hasLinkField) : sp.plans).map((p2) => p2.name) }));
+}
 function ruleFor(spec, op) {
   const rls = spec.rls;
   if (!rls || typeof rls !== "object") return void 0;
@@ -167950,7 +168022,7 @@ function planEntityScreens(specs, app = "") {
   if (names2.length <= ENTITY_TAB_SLOTS) return { plans, tabs: names2, more: [] };
   return { plans, tabs: names2.slice(0, ENTITY_TAB_SLOTS - 1), more: names2.slice(ENTITY_TAB_SLOTS - 1) };
 }
-var PlanError, RESERVED_SCREEN_IDS, MORE_SCREEN_ID, ENTITY_TAB_SLOTS, OWNER_RULES, pascal, PREFERRED_TITLES, LONG_TEXT, IMAGE_KEY, SEGMENTED_MAX, isPlainString, isEnum, isDate, isImage, isLongText, nounOf;
+var PlanError, RESERVED_SCREEN_IDS, MORE_SCREEN_ID, ENTITY_TAB_SLOTS, OWNER_RULES, pascal, PREFERRED_TITLES, LONG_TEXT, IMAGE_KEY, SEGMENTED_MAX, isPlainString, isEnum, isDate, isImage, isLongText, hasLinkField, nounOf;
 var init_plan4 = __esm({
   "src/base44-screens/plan.ts"() {
     init_base44_schema();
@@ -167976,6 +168048,7 @@ var init_plan4 = __esm({
     isDate = (f2) => f2.type === "string" && (f2.format === "date" || f2.format === "date-time");
     isImage = (f2) => f2.type === "string" && !isEnum(f2) && (f2.format === "file" || IMAGE_KEY.test(f2.key));
     isLongText = (f2) => f2.type === "string" && !isEnum(f2) && (f2.format === "richtext" || LONG_TEXT.test(f2.key));
+    hasLinkField = (p2) => p2.detail.some((d2) => d2.show === "link");
     nounOf = (display) => display.split(" ").map((w2) => /^[A-Z]{2,}s?$/.test(w2) ? w2 : w2.toLowerCase()).join(" ");
   }
 });
@@ -168027,13 +168100,25 @@ export default defineEntityList(PLAN);
 `;
 }
 function renderDetailEntry(p2) {
-  return `// One ${p2.name} (${p2.ids.detail}), pushed from ${p2.ids.list} with its id \u2014 generated by \`himi base44 screens\`.
+  if (!hasLinkField(p2)) {
+    return `// One ${p2.name} (${p2.ids.detail}), pushed from ${p2.ids.list} with its id \u2014 generated by \`himi base44 screens\`.
 // The behaviour lives in the shared engine (../_shared/entity-detail.ts); this file only names the
 // entity's plan.
 import { defineEntityDetail } from "../_shared/entity-detail.js";
 import { PLAN } from "../_shared/${planFile(p2)}.js";
 
 export default defineEntityDetail(PLAN);
+`;
+  }
+  return `// One ${p2.name} (${p2.ids.detail}), pushed from ${p2.ids.list} with its id \u2014 generated by \`himi base44 screens\`.
+// The behaviour lives in the shared engine (../_shared/entity-detail.ts); this file names the
+// entity's plan and hands it \`open\`, which an email / URL fact opens through (the open_url
+// capability \u2014 only an entity with such a field imports it).
+import { open } from "@himalaya/open-url";
+import { defineEntityDetail } from "../_shared/entity-detail.js";
+import { PLAN } from "../_shared/${planFile(p2)}.js";
+
+export default defineEntityDetail(PLAN, { open });
 `;
 }
 function renderDevRegistrations(sp) {
@@ -184220,7 +184305,8 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            --live runs the worker's fetches against REAL Wix (minted visitor token) and awaits
                                            load(), so the render shows LIVE data (needs network + a Wix clientId in config.ts);
                                            --mocks runs load() against the app's OWN recorded data instead \u2014 dev/net-mocks.json
-                                             (what \`himi test --record\` writes) and the config's cms seed rows, as \`himi test\`'s
+                                             (what \`himi test --record\` writes), the config's cms seed rows, and for a Base44 app
+                                             its base44.entities seed rows then the analyze book's sample rows, as \`himi test\`'s
                                              shots do; no request leaves this machine. With none, it renders the initial state.
                                              It is the DEFAULT whenever the app has recorded data (mocks.default in the output);
                                              --no-mocks renders the offline initial state instead;
@@ -184773,7 +184859,9 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            base44.entities entity (base44-starter packages), write
                                            controls gated by each entity's rls. Re-running is a
                                            no-op; a hand-edited generated file is skipped-edited
-                                           unless --force. Never calls Base44.
+                                           unless --force. An email / URL field opens through
+                                           open_url, so config.ts capabilities must list it
+                                           (else missing_capability). Never calls Base44.
   himi base44 entities create [--app <a> | --content <dir>] [--yes] [--allow-destructive]
                               [--apply-permissions] [--empty-app-ok]
                                            create/update the app's OWNED Himi<App>* entities. Base44's
@@ -184926,7 +185014,7 @@ var COMMANDS2 = [
   { name: "ux", summary: "audit or record mobile UX evidence. `audit` checks the public-safe contract, seeded blank acceptance rows, placeholder source copy, app-specific mocks, and iOS/Android audit records. It warns while existing templates migrate; `--strict` promotes missing evidence. `record` stores checks performed on an installed iOS/Android build: `--checks` is required for passed|failed and empty for unavailable, which drove nothing and needs a `--reason` instead. `record` also STAMPS the release it audited (it resolves the id from a build, the same one a push would publish), because an unforced `himi push` of a release with screens refuses when no drive is recorded for THAT release, or when the one that is recorded says `failed` \u2014 the artifact stopped being advice nobody reads (#2955). `unavailable` still satisfies it; only `failed` refuses.", required: "audit [--content <dir>] [--strict] [--json] | record --content <dir> --platform ios|android --status passed|failed|unavailable [--checks back,keyboard,...] [--reason <text>]" },
   { name: "progress", summary: 'the build JOURNAL an agent keeps for the owner while it works. `himi progress "<what changed>" --step <1-8|name> --image <png>` appends one postcard to .himi/progress.jsonl \u2014 the step is one of the customer journey\'s eight (discover, classify, plan, implement, brand, validate, review, download) \u2014 and COPIES each image, content-addressed, into .himi/history/, because .himi/shots/ is overwritten by every render and cleared by every full `himi test`, so a path into it would later show a different picture than the one the owner was sent. --image repeats. With NO --image, the home screen\'s current shot is attached automatically, only when it is no older than the last source change and not the picture the latest journaled postcard already shows \u2014 and never a shot that landed on loading placeholders, an empty or an error state (.himi/shot-states.json): then the newest home picture of the current source that shows content goes on instead (its .himi/history copy, `imageNote` saying so), or none \u2014 except on the HANDOVER card (`--step review`), where a repeat is the point and it attaches anyway; that card\'s output also names the making-of (`makingOf`, .himi/making-of.html, rebuilt when missing or older than the journal so it ends on this card) and its `next` says to hand it to the owner beside the preview link; `imageAttached` in the output says whether the postcard carries a picture (with `imageNote` saying why not, or which picture went on instead), and `--no-image` sends a text-only postcard. --notify also raises a best-effort desktop notification for an owner who stepped away. A bare `himi progress` prints the journal with the current step and elapsed time \u2014 also how an agent recovers its place after its context was compacted. APPROVALS: `--approve <gate> "<what>"` records one the customer just gave (gates: site-create, connect, private-data, draft, promote, push-signing, qa-build) in .himi/approvals.jsonl, and `--done <gate>` / `--drop <gate>` closes it \u2014 an approval is owed until then, and the chat that held it does not survive a new session. `--brief` prints plain text for a session start: the current step, the last postcard, every open approval, and whether this app\'s agent files are stale \u2014 the SessionStart hook `himi agent-init` installs runs exactly this. The CLI also journals milestones by itself \u2014 the first PNG render of the home screen (for an app a current `himi init` started: once as the template\'s "Starting point" while the source is what init wrote, then once as "First look at your app" after it diverges, Markdown edits not counting; once per app otherwise), a `himi test` crawl whose outcome changed since the last one (its counts or its home picture; an identical re-run writes none, and a repeat names what changed: "The home screen changed since the last crawl." or the changed counts, was \u2192 now), every draft push (with the home picture only when that shot is newer than the last source edit \u2014 otherwise the postcard says why and names `himi render <home> --png`), and ONE rule for a long silence: a successful home `render --png` more than ten minutes after the newest postcard of any kind, with a picture the latest postcard does not show, journals "Still building: here\'s the home screen now." with it (never twice within the window). When a crawl\'s or a draft\'s home picture is the first of an app whose source diverged, "First look at your app" is journaled first, from that shot, once. All are marked `"by": "himi"`; they never move the journey step, carry no link or credential, and step aside (folded out of every reader) when the agent journals the same step or picture within five minutes. Local only: nothing is sent anywhere.', required: '["<message>" [--step <1-8|name>] [--image <png>]\u2026 [--no-image] [--notify]] [--content <dir>] | --approve|--done|--drop <gate> ["<note>"] | --brief' },
   { name: "studio", summary: "open the BUILD BOARD \u2014 one local page the owner can leave open while an agent builds their app, which fills itself in: every screen as it renders (NEW/CHANGED badges, and each earlier version kept for a filmstrip), the journey stepper and the latest postcard from `himi progress`, the validate/test/UX/draft checks as they run, the site next to the app's home screen with its palette, and the navigation the test crawl followed. Writes .himi/studio/index.html and opens it; the page re-reads its state every two seconds, so nothing needs to be served. OPT-IN BY EXISTENCE: until this command (or `himi init`, which makes the board for every app it creates, without opening a browser) has run, no other command touches .himi/studio/ \u2014 after it, render/test/validate/push/icon/site/ux/progress each refresh the board as they finish (best-effort; never fails a command). Every image is a content-addressed copy in .himi/history/, never a live path into .himi/shots/. Local only, no secrets: it never reads a preview token, handover code or control token. --no-open prints the path instead (SSH, CI). `himi studio reel` writes the MAKING-OF: one self-contained HTML file (every image inlined, nothing fetched) with a flipbook of the home screen version by version, captioned by the postcard in effect at the time, the final screens, and every postcard \u2014 sized to stay attachable, thinning frames first. Defaults to .himi/making-of.html (never archived by push), which every successful `himi push --draft` also rebuilds and names as `reel` in its output; --out to put it elsewhere. The output names that file as the one to hand the owner (`handover: {file, hint}` in JSON; two plain lines at a terminal) \u2014 beside the preview link, never instead of it.", required: "[--content <dir>] [--no-open] | reel [--out <file>] [--no-open]" },
-  { name: "render", summary: "headless-render a screen with the web renderer: render-tree + diagnostics, optional --png [<file>] (bare: .himi/shots/<id>.png, what the build board shows), --scheme dark, --tree. Local by default (content dir). Pass --remote --app --release to hit GET /v1/preview/\u2026/render on the serve plane after a push. Boots the worker so $service bindings resolve; --static raw bindings; --live real Wix fetches; --mocks (the DEFAULT whenever the app has recorded data; --no-mocks for the offline initial state) runs load() against the app's own recorded data (dev/net-mocks.json from `himi test --record`, then the config's cms seed rows \u2014 hermetic, never a request; with neither it paints the initial state, and `mocks: {used: false}` says why), which is what the automatic pictures use, so they show the app's content instead of its offline placeholders; --state injects worker state; --input supplies pre-boot navigation params; --width/--device for PNG viewport; --rtl for dir=rtl + $env:isRTL.", required: "<screenId> [--content <dir>] [--scheme dark] [--png [<file>]] [--tree] [--static] [--live] [--mocks | --no-mocks] [--state <json|file>] [--input <json|file>] [--width <px> | --device <name>] [--rtl] [--remote --app --release]" },
+  { name: "render", summary: "headless-render a screen with the web renderer: render-tree + diagnostics, optional --png [<file>] (bare: .himi/shots/<id>.png, what the build board shows), --scheme dark, --tree. Local by default (content dir). Pass --remote --app --release to hit GET /v1/preview/\u2026/render on the serve plane after a push. Boots the worker so $service bindings resolve; --static raw bindings; --live real Wix fetches; --mocks (the DEFAULT whenever the app has recorded data; --no-mocks for the offline initial state) runs load() against the app's own recorded data (dev/net-mocks.json from `himi test --record`, then the config's cms seed rows, and the Base44 layer `himi test` uses \u2014 base44.entities seed rows and the analyze book's sample rows \u2014 hermetic, never a request; with neither it paints the initial state, and `mocks: {used: false}` says why), which is what the automatic pictures use, so they show the app's content instead of its offline placeholders; --state injects worker state; --input supplies pre-boot navigation params; --width/--device for PNG viewport; --rtl for dir=rtl + $env:isRTL.", required: "<screenId> [--content <dir>] [--scheme dark] [--png [<file>]] [--tree] [--static] [--live] [--mocks | --no-mocks] [--state <json|file>] [--input <json|file>] [--width <px> | --device <name>] [--rtl] [--remote --app --release]" },
   { name: "cms", summary: "inspect, provision, and seed the app's CMS (Wix Data) collections, declared as a `cms` block in config.ts. `query` is READ-ONLY \u2014 by default it fetches ONLY the physical ids `config.ts` declares (item counts + schema drift) and reports `siteScanned: false`; it never lists the site, so an UNDECLARED `himi_<app>_` collection this app owns is not reached without `--all`. `--all` SCANS the site \u2014 every collection it lists is labeled `owned`/`adopted`/`foreign`, and it describes every foreign one \u2014 id, non-system field keys + types, and the site's read role \u2014 so an app with no `cms` block at all can DISCOVER a collection to adopt (`--all` is the one case where a missing `cms` block is not 'nothing to do'). Foreign collections are described up to a cap and are never item-counted (`itemCount: null`), because a row count is one query each; `foreign.count` is how many the scan LISTED \u2014 it follows the list endpoint's pages, and `listingIncomplete: true` says when the walk stopped short of the end, with `unlistedCollections` counting what it left out when Wix gave a paging total \u2014 and `foreign.truncated` says how many of those went undescribed, each still NAMED in `foreign.others` (id + displayName), so a collection the site already has is never hidden behind the cap. The scan is OWNER-scoped \u2014 it needs --site <msid> (or WIX_SITE_ID) plus owner auth via `wix token`; a visitor token can read a public collection's ITEMS but can never enumerate collections, so there is no tokenless discovery path. `create` reconciles declared collections additively and idempotently, and REFUSES any id outside the app's `himi_<app>_` namespace, so it is safe against a production site. It reports declared-vs-site `permissionDrift` but never writes permissions unless asked with --apply-permissions, so a field reconcile can't silently revert access control changed in the dashboard. `seed` inserts the git-tracked `seed:` rows into EMPTY owned collections (--force to add to a non-empty one; --ai writes placeholder rows plus a refinement prompt for you to review). Adopted collections (declared by `wixId`) are read-only and never created, updated, or seeded. Site from --site <msid> or WIX_SITE_ID; owner auth via `wix token`.", required: "query|create|seed [--site <msid>] [--content <dir>] [--all] [--dry-run] [--force] [--allow-destructive] [--apply-permissions] [--only <id>] [--ai] [--count <n>]" },
   { name: "data", summary: "read-only plan or explicitly provision/seed declared KV and Wix Data resources. Preview and production are separate scopes. KV administration uses the operator data plane from --data-url/HIMI_DATA_ADMIN_URL and HIMI_DATA_ADMIN_TOKEN; draft push never calls it.", required: "plan|create|seed [--site <msid>] [--environment preview|production] [--content <dir>] [--data-url <url>] [--dry-run] [--force]" },
   { name: "icons", summary: "list the valid Icon.name vocabulary (an unknown name renders a fallback glyph; validate warns on unknown names) (offline)", required: "[--json]" },
@@ -188818,7 +188906,8 @@ ${[...afterRun.next, ...testReminder ? [testReminder] : []].join("\n")}`);
           }
           const cmsSeed = await cmsSeedRows(dir, app).catch(() => null);
           const seeded = cmsSeed && Object.keys(cmsSeed).length ? cmsSeed : null;
-          const picked = renderMocksFrom(rules, bad2, seeded);
+          const base44Data = await base44CrawlData(dir, app).catch(() => null);
+          const picked = renderMocksFrom(rules, bad2, seeded, base44Data);
           mocks = picked.mocks;
           if (!mocksByDefault || bad2) mocksNote = picked.note;
         }
@@ -188830,7 +188919,7 @@ ${[...afterRun.next, ...testReminder ? [testReminder] : []].join("\n")}`);
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
           // The settled state is always kept (printed only under --dump-state): it is what says whether
           // the picture landed on the screen's content or on its error, loading or empty state.
-          collect: { lint: true, strict, render: { screenId, scheme, png: wantPng, hydrate, dumpState: true, ...live3 ? { live: true } : {}, ...injectedState ? { state: injectedState } : {}, ...injectedInput ? { input: injectedInput } : {}, ...renderWidth ? { width: renderWidth } : {}, ...flags.rtl === true ? { rtl: true } : {}, ...loadBudgetMs ? { loadBudgetMs } : {}, ...mocks ? { mocks: { rules: mocks.rules, cmsSeed: mocks.cmsSeed } } : {} } }
+          collect: { lint: true, strict, render: { screenId, scheme, png: wantPng, hydrate, dumpState: true, ...live3 ? { live: true } : {}, ...injectedState ? { state: injectedState } : {}, ...injectedInput ? { input: injectedInput } : {}, ...renderWidth ? { width: renderWidth } : {}, ...flags.rtl === true ? { rtl: true } : {}, ...loadBudgetMs ? { loadBudgetMs } : {}, ...mocks ? { mocks: { rules: mocks.rules, cmsSeed: mocks.cmsSeed, ...mocks.base44Data ? { base44Data: mocks.base44Data } : {} } } : {} } }
         });
         const r2 = (outcome.renders ?? [])[0];
         if (!r2) {
@@ -192860,9 +192949,12 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
           }
           const app = await appId(dir);
           let base44;
+          let appCapabilities;
           try {
             const { loadAppConfigModule: loadAppConfigModule2 } = await Promise.resolve().then(() => (init_app_config_loader(), app_config_loader_exports));
-            base44 = (await loadAppConfigModule2(dir))?.base44;
+            const loaded = await loadAppConfigModule2(dir);
+            base44 = loaded?.base44;
+            appCapabilities = loaded?.capabilities;
           } catch (e2) {
             const finding = (await Promise.resolve().then(() => (init_base44_lint(), base44_lint_exports))).base44DefineAppFinding(e2);
             if (finding) {
@@ -192881,7 +192973,7 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
             io2.error(JSON.stringify({ ok: false, code: "invalid_config", app, issues: errors, hint: '`himi validate` reports these with pass: "base44"' }));
             return 1;
           }
-          const { planEntityScreens: planEntityScreens2, PlanError: PlanError2 } = await Promise.resolve().then(() => (init_plan4(), plan_exports));
+          const { planEntityScreens: planEntityScreens2, PlanError: PlanError2, missingCapabilities: missingCapabilities2, requiredCapabilities: requiredCapabilities2 } = await Promise.resolve().then(() => (init_plan4(), plan_exports));
           let sp;
           try {
             sp = planEntityScreens2(specs, app);
@@ -192889,6 +192981,18 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
             if (e2 instanceof PlanError2) return fail6(e2.code, e2.message, { app, ...e2.extra });
             throw e2;
           }
+          const { catalogKey: catalogKey2, expandCapabilities: expandCapabilities2 } = await Promise.resolve().then(() => (init_src2(), src_exports));
+          const declaredCaps = expandCapabilities2((Array.isArray(appCapabilities) ? appCapabilities : []).filter((c2) => typeof c2 === "string").map(catalogKey2));
+          const missingCaps = missingCapabilities2(sp, declaredCaps);
+          if (missingCaps.length) {
+            const [first] = missingCaps;
+            return fail6("missing_capability", `config.ts capabilities does not declare "${first.capability}", which the generated screens need (${first.entities.join(", ")})`, {
+              app,
+              capability: first.capability,
+              missing: missingCaps,
+              hint: `add it \u2014 capabilities: [..., ${missingCaps.map((m2) => `"${m2.capability}"`).join(", ")}] \u2014 then re-run; the native config follows from the capability catalog (himi docs capabilities). Nothing was written.`
+            });
+          }
           const rendered = gen.renderAll(sp);
           const dryRun = flags["dry-run"] === true;
           const { files } = gen.writeGenerated(dir, rendered, { force: flags.force === true, dryRun });
@@ -192899,6 +193003,7 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
             ...dryRun ? { dryRun: true } : {},
             files,
             plans: sp.plans.map((p2) => ({ entity: p2.name, physical: p2.entity, list: p2.ids.list, detail: p2.ids.detail, gates: p2.gates })),
+            capabilities: requiredCapabilities2(sp),
             tabs: sp.tabs,
             more: sp.more,
             ...orphaned.length ? { orphaned, note: "generated files for entities no longer declared \u2014 never deleted; remove them by hand if the screens should go" } : {},

package/guides/base44-app-to-himi-app.md

@@ -139,12 +139,12 @@ Write `.himi/screen-plan.md` before editing code. For each entity in `book.entit
 | `string` + long text (`description`, `notes`, `body`, …) | `Text` with `maxLines` | `TextField` with `multilineMaxLines` |
 | `string` + `enum` | `Badge` / `Text` | `SegmentedControl` (≤ 4 values) or `Picker` |
 | `string` + `format: date` / `date-time` | formatted `Text` | `DatePicker` |
-| `string` + `format: email` / `uri` | `Text` (the generator does not make it tappable yet) | `TextField` with `keyboard: "email"` / `"url"` |
+| `string` + `format: email` / `uri` | a tappable row: an email opens mail, a URL the in-app browser, through `@himalaya/open-url` (needs `open_url`, below) | `TextField` with `keyboard: "email"` / `"url"` |
 | `string` holding an image URL (`image`, `photo`, `avatar`, `*_url`) | `Image` | read-only, see [file upload](#what-the-sdk-cannot-do) |
 | `number` / `integer` | `Text` (with unit) | `Stepper` (small ranges) or numeric `TextField` |
 | `boolean` | `Badge` or `Text` | `Toggle` |
-| `array` of strings | comma-joined `Text` | `ChipsInput` |
-| `object` / nested `array` of objects | its JSON as `Text` (a sub-section of rows is yours to build) | none. Edit it on the web app |
+| `array` of strings | read-only `FilterChips` (no selection, no `onChange`) | `ChipsInput` |
+| `object` / nested `array` of objects | a labelled sub-section of key/value rows, one level deep: one row per key (an array: one row per item, `Item 1`, …), a deeper value inline as `Key: value · …` | none. Edit it on the web app |
 | built-ins `id`, `created_date`, `updated_date`, `created_by` | "Created …" metadata row | never editable |
 
 4. **Respect the entity's rules.** `rls` (and field-level `rls`) decide what the signed-in user
@@ -161,7 +161,17 @@ Write `.himi/screen-plan.md` before editing code. For each entity in `book.entit
    A field whose field-level `rls.write` is not `true` is read-only in the form. The gate is
    advisory: a denied call still fails with Base44's message, and every screen paints that error
    rather than swallowing it.
-5. **Use the sample rows** (`sampleRows`, already redacted) to size rows and choose the subtitle,
+5. **Declare `open_url` when an entity has an email or URL field.** The detail opens those facts
+   through `@himalaya/open-url`, so the app must list the capability:
+   `capabilities: ["base44", "open_url"]` in `config.ts`. Without it `himi base44 screens` writes
+   nothing and fails with `code: "missing_capability"` (`capability: "open_url"`, and `missing[]`
+   names the entities that need it). The binary's native config follows from that list (the
+   capability catalog, `himi docs capabilities`), so a shell built without it needs a new
+   `himi dist`. Only the detail of an entity with such a field imports `@himalaya/open-url` and
+   declares `open_url`. A value that is not an address or an http(s) URL (`javascript:`, an app
+   scheme) is shown as plain text and never opened. A link, chips or section fact with no value
+   shows a `—` row instead.
+6. **Use the sample rows** (`sampleRows`, already redacted) to size rows and choose the subtitle,
    never as data the app ships.
 
 Compose each screen with [`designing-himi-screens`](designing-himi-screens.md)
@@ -202,8 +212,10 @@ Re-running is safe. Each generated file starts with
   `skipped-edited` and left alone, and the command still exits 0. Pass `--force` to overwrite it;
 - files for an entity you removed from `config.ts` are reported in `orphaned[]` and never deleted.
 
-`--dry-run` reports the same outcomes without writing. Failures carry a top-level `code`
-(`no_entities_block`, `entity_id_collision`, `content_dir_not_base44_starter`), per
+`--dry-run` reports the same outcomes without writing. On success `capabilities[]` lists what the
+generated screens need (`base44`, plus `open_url` with a link field). Failures carry a top-level
+`code` (`no_entities_block`, `entity_id_collision`, `missing_capability`,
+`content_dir_not_base44_starter`), per
 [`himi-json-output`](himi-json-output.md). The generator never calls Base44.
 
 To change a screen beyond what the plan expresses (a filtered list, a child section, a custom

package/guides/himi-json-output.md

@@ -324,9 +324,14 @@ on stderr (exit 1):
 - `no_entities_block`: `config.ts` declares no `base44.entities`, so there is nothing to generate.
 - `entity_id_collision`: two entities would generate the same screen id (or one would shadow
   `b44_functions` / `b44_account` / `b44_more`); `entity`, `screenId` and `with` name the clash.
+- `missing_capability`: an entity has an email / URL field, which the detail opens through
+  `@himalaya/open-url`, and `config.ts` `capabilities` does not list `open_url`. `capability` names
+  it and `missing[]` gives `{ capability, entities }` per missing id. Nothing is written. Add it to
+  `capabilities` and re-run.
 - `config_unloadable` / `invalid_config`: as for `himi base44 entities` above.
 
-On success (`ok: true`, stdout, exit 0) `files[]` gives every generated path with its `outcome`:
+On success (`ok: true`, stdout, exit 0) `capabilities[]` lists the ids the generated screens need
+(`base44`, plus `open_url` with a link field), and `files[]` gives every generated path with its `outcome`:
 `written`, `unchanged`, or `skipped-edited` (the file was edited by hand and was left alone; pass
 `--force` to overwrite it). A skipped file is not a failure. `orphaned[]`, when present, lists
 generated files for entities no longer declared. They are never deleted.

package/guides/himi-test.md

@@ -219,7 +219,8 @@ every run; record against a **QA site**, never production. See
 
 **The pictures use it too.** `himi render <id> --png` runs the worker's load against the same
 recorded data whenever the app has some — `dev/net-mocks.json`, then the config's cms seed rows,
-never the canned fixture and never a request — so a data-driven screen paints its content instead
+and for a Base44 app the same Base44 layer `himi test` uses (`base44.entities` seed rows, then the
+analyze book's sample rows) — never the canned fixture and never a request — so a data-driven screen paints its content instead
 of its offline placeholders. It is the default (`mocks.default` in the output); `--mocks` asks for
 it explicitly, `--no-mocks` renders the offline initial state, and `--live`, `--static` and
 `--state` each render the data they name instead. The automatic pictures (`himi init`'s first look,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1436.0",
+  "version": "0.1438.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "f7ae66a60361733dac4fb8eca6e9d6ded412ab35390c6dea84350b76"
+  "falconPackageHash": "ecadfa529dda6d1f49570340c04988f711cb239a5209ce8c69e31e86"
 }